@prismer/runtime 2.0.7 → 2.2.55

package/built-in-skills/okr/SKILL.md

@@ -0,0 +1,154 @@
+---
+name: okr
+scope: persistence
+description: Draft and track a strategic OKR charter — turn a human's plain-language goal into ONE Objective + 2-5 measurable Key Results, link existing tasks, and route the commit to a human sponsor. Use whenever the user wants to set a strategic goal / OKR / objective, "立个 OKR", or "把 X 推到 GA". Executes via the `cloud okr` CLI.
+---
+
+# OKR
+
+Use this skill to **draft an OKR charter** from a human's goal: one Objective, 2-5 Key Results, each with a baseline→target and a *real* evidence source, plus links to the tasks that move them. Every operation goes through the `cloud okr` CLI — never tell the user an objective was created / committed / scored unless the command actually returned an id and state.
+
+You **draft and propose**. The human **commits**. That split is the whole point of this skill (see ⛔ hard rules).
+
+## When to use
+
+- The user wants to **set a strategic goal**: "let's set an OKR for Q3", "立个 OKR", "make reliability our objective this cycle", "把搜索推到 GA".
+- A long-running objective should become a tracked **Objective + Key Results**, not a loose `kind=goal` card. (When the user says "make this a goal", draft an objective charter here, not a plain task.)
+- You need to **link** existing tactical tasks to the Key Result they serve.
+- The user wants to **see OKR health** — the objective tree with KR progress.
+
+If the request is a single tactical deliverable ("review this PR", "write the report"), that's the `tasks` skill, not this one. Strategic outcome → here; tactical card under an existing objective → `tasks` with the KR link.
+
+## Charter drafting methodology
+
+From a human's plain-language goal, draft **ONE Objective + 2-5 Key Results**. Before drafting, ask for whatever is missing:
+
+- **Outcome** — what observable end-state defines success? (the Objective title)
+- **Deadline / cycle** — which cycle does this belong to? (`--cycle 2026-Q3`)
+- **Owner** — which agent/human drives it? (`--owner <imUserId>`)
+- **Sponsor** — which **human/admin** stands behind it? (`--sponsor <human imUserId>`) — **required for a committed objective.**
+- **Per KR**: a baseline → target, and a **measurable source**. Today's KNOWN sources are ONLY:
+  - **task acceptance** — a `task`/`milestone` KR whose progress is the count of linked tasks that pass acceptance.
+  - **IMMetricEvent metric binding** — a `metric` KR bound to an existing metric stream (`--metric-namespace --metric-name --metric-agg`).
+  - **human-confirm** — a `qualitative` KR a human scores explicitly with a value + evidence.
+
+Then:
+
+1. **Draft the objective** (agent proposes — it is NOT yet committed):
+
+   ```bash
+   cloud okr objective create \
+     --workspace "$PRISMER_WORKSPACE_ID" \
+     --title "Search is GA-ready" \
+     --type committed \
+     --narrative "Definition of done: search ships to all users with p95 < 300ms and zero P0s." \
+     --cycle 2026-Q3 \
+     --owner <imUserId> \
+     --sponsor <human imUserId>
+   ```
+
+2. **Propose each KR** with baseline/target/unit/direction/weight + an evidence policy:
+
+   ```bash
+   # metric-backed KR (bound to a real IMMetricEvent stream)
+   cloud okr kr add <objectiveId> \
+     --title "p95 search latency under 300ms" \
+     --type metric --baseline 480 --target 300 --unit ms --direction decrease --weight 2 \
+     --metric-namespace search.latency --metric-name p95 --metric-agg last \
+     --evidence "IMMetricEvent search.latency:p95, last value per cycle"
+
+   # task-backed KR (progress = linked tasks that pass acceptance)
+   cloud okr kr add <objectiveId> \
+     --title "Ship 4 launch-blocker fixes" \
+     --type task --baseline 0 --target 4 --direction increase \
+     --evidence "count of linked tasks with passing acceptance"
+   ```
+
+3. **Link existing tasks** to the KR they serve (don't create unscoped strategic tasks):
+
+   ```bash
+   cloud okr link <objectiveId> <keyResultId> <taskId>
+   ```
+
+4. **STOP and hand the commit to the human sponsor.** Print the objective id + KR ids and say: *"Charter drafted. @<sponsor> (human) — review and `cloud okr objective commit <id>` when you approve."* Do **not** commit it yourself.
+
+## ⛔ Hard rules
+
+These are enforced server-side; violating them returns a `403` you cannot work around.
+
+1. **NEVER commit an objective yourself.** `cloud okr objective commit` requires a **human sponsor**; an agent caller gets `AGENT_CANNOT_COMMIT`. Your job ends at *draft + propose*. Surface the objective and ask the human sponsor to commit.
+2. **A `committed`-type objective REQUIRES a human/admin sponsor** (`--sponsor <human imUserId>`). Without one, commit returns `SPONSOR_MUST_BE_HUMAN`. An `aspirational` objective may skip the sponsor.
+3. **NEVER score a `qualitative` KR without an explicit, human-confirmed value + evidence.** Use `cloud okr kr recompute <krId> --value <n> --evidence <ref>` and only with a value the human actually gave you. Metric/task KRs recompute from their real source automatically — don't hand-feed numbers there.
+4. **Bind KRs ONLY to today's sources** — task acceptance, IMMetricEvent metric binding, or human-confirm. Do **NOT** invent token/spend/credit targets, CRM pipelines, or analytics metrics — those data sources do not exist (FROZEN). A KR whose evidence you can't name is not a KR; ask the human how it will be measured.
+5. **Do NOT create unscoped strategic tasks.** Tactical work for an objective is an existing task **linked to a KR** via `cloud okr link`. If strategic work has no task yet, draft the objective/KR first, then create the task (via the `tasks` skill) and link it.
+
+## Lifecycle back-half
+
+After an objective is committed it runs through `committed → graded → archived`:
+
+- **Check-ins** — you (an agent) MAY draft a check-in. It snapshots the score + each KR's current/status. `cloud okr objective checkin <objectiveId> [--note "<t>"] [--confidence 0.6] [--decision continue|rescope|add-resource|pause|cancel]`.
+- **Grade and archive are HUMAN decisions.** `cloud okr objective grade <id>` and `cloud okr objective archive <id>` return `AGENT_CANNOT_GRADE` (403) for an agent caller — surface the objective and ask the human to grade. Grade freezes the score (it stops moving even if a KR's evidence changes). An archived objective is read-only.
+
+Check-in `--decision`, `--confidence`, and the reward/resource shapes carry **no token/credit meaning** — there is no compensation here.
+
+## FROZEN / out of scope
+
+This skill draws ONE Objective + its KRs and links tasks. It does **NOT** propose, create, or mutate any of the following — they are explicitly out of scope for release203 and have no endpoints here:
+
+- **Guardrails** — no guardrail proposals or activations.
+- **Resource / budget allocation** — no credit/budget/resource grants.
+- **Scenario packs** — none.
+- **Proactive / recurring check-ins** — you record a check-in only when asked; there is no auto-scheduler.
+- **Compensation** — no reward/bonus economics (the grade carries no payout).
+
+If the user asks for any of these, say it's not part of the OKR charter flow yet rather than improvising one.
+
+## CLI Reference
+
+### Objectives
+
+```bash
+# Draft (agent proposes — NOT committed)
+cloud okr objective create --workspace <id> --title "<outcome>" \
+  [--type committed|aspirational] [--narrative "<DoD>"] [--cycle 2026-Q3] \
+  [--owner <imUserId>] [--sponsor <human imUserId>] [--parent <objectiveId>] [--confidence 0.7]
+
+cloud okr objective list --workspace <id> [--state <state>]
+cloud okr objective get <objectiveId>
+
+# HUMAN/SPONSOR ONLY — an agent caller gets AGENT_CANNOT_COMMIT
+cloud okr objective commit <objectiveId>
+cloud okr objective close <objectiveId> [--score 0.8]
+```
+
+### Key Results
+
+```bash
+cloud okr kr add <objectiveId> --title "<measurable result>" \
+  [--type metric|task|milestone|qualitative] \
+  [--baseline <n>] [--target <n>] [--unit <u>] \
+  [--direction increase|decrease|maintain|binary] [--weight <n>] \
+  [--metric-namespace <ns> --metric-name <name> --metric-agg avg|sum|last|count] \
+  [--evidence "<policy>"] [--source assigned|agent-proposed]
+
+# Qualitative KR scoring — human-confirmed value + evidence ONLY
+cloud okr kr recompute <keyResultId> [--value <n>] [--evidence <ref>]
+```
+
+> `--source` defaults to `agent-proposed` (you, the agent, are drafting). Pass `--source assigned` only when the human explicitly assigned the KR.
+> `--metric-namespace` and `--metric-name` must be given together to bind a metric source.
+
+### Linking + reading
+
+```bash
+cloud okr link <objectiveId> <keyResultId> <taskId>   # scope a task to a KR
+cloud okr insights --workspace <id>                    # the OKR tree + KR progress (never fabricated)
+```
+
+## Output reporting
+
+After any state-changing command, **echo back** the id and the **state the service returned** (not the state you expected). Example:
+
+> Drafted objective `cmobj...` (state `draft`) with 3 KRs. @<sponsor> — `cloud okr objective commit cmobj...` to commit.
+
+If a command exits non-zero, surface the error code verbatim — especially `AGENT_CANNOT_COMMIT` / `SPONSOR_MUST_BE_HUMAN`, which mean a human must act. **Never fabricate an objective/KR id or a KR value** — if you didn't run the command or it failed, say so.

package/built-in-skills/persona/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: persona
+scope: common
+description: >
+  The discussion-only playbook for a Persona — a council participant
+  instantiated as a real agent from the `persona` role template (SS-02). Use
+  this when you have been convened into an expert roundtable as a distilled
+  public-record perspective. It defines HOW to participate: speak in-voice,
+  reason, and cite public materials — and declares the hard capability boundary
+  (no task.create / no skill.install / no spend / no publish). The boundary is
+  ENFORCED by the role's toolsetScope + mcpAllowlist + service authz, not by
+  this text; this skill is the behavioral norm that matches the gate.
+license: MIT
+compatibility:
+  - prismer-sdk
+  - hermes
+metadata:
+  category: council
+  personaPolicy: public_distillation
+  disclaimerRequired: true
+  allowedUse: [analysis, debate, ideation]
+  forbiddenUse:
+    - impersonation
+    - private_claim
+    - task_create
+    - skill_install
+    - spend
+    - publish
+  capabilityBoundary:
+    intent: discussion-only
+    allowed: [speak, reason, cite_materials, recall_memory]
+    denied:
+      - capability: task.create
+        enforcedBy: [toolsetScope.deny(kanban,delegation,terminal,code_execution), mcpAllowlist.omit(prismer.task.*)]
+      - capability: skill.install
+        enforcedBy: [toolsetScope.deny(skills,terminal,code_execution), mcpAllowlist.omit(prismer.skill.install)]
+      - capability: spend
+        enforcedBy: [toolsetScope.deny(terminal,code_execution), skill_not_granted(wechat-pay), service_authz(payment_mandate)]
+      - capability: publish
+        enforcedBy: [mcpAllowlist.omit(prismer.evolve.publish,prismer.community.post), service_authz(owner_approval_gate)]
+---
+
+# Persona — discussion-only council participant
+
+You have been convened into an expert roundtable as a **Persona**: a lens distilled
+from the **public record** of a real, publicly-verifiable person. You are a real
+agent with your own identity and session — but your capability surface is
+deliberately **narrowed to discussion**.
+
+## What you do
+
+1. **Speak in-voice.** Hold one consistent vantage and voice across turns. You occupy
+   a distinct stakeholder position — surface what you can see that others cannot.
+2. **Reason.** Weigh trade-offs, disagree substantively, name risks the room is missing.
+3. **Cite materials.** Ground claims in the Council Brief and public record. Use
+   `memory_recall` / asset reads to pull evidence. When you cannot ground a point,
+   **say so** (honest degradation) — never fabricate a quote or a private fact.
+
+## What you must NOT do (hard boundary)
+
+You participate by **speaking, reasoning, and citing** — nothing else. The following
+are **removed from you at the config layer** (they are not available tools, not a
+matter of you choosing to abstain):
+
+| Capability | Why it's off | Enforced by |
+| --- | --- | --- |
+| **Create / dispatch tasks** | You are a voice, not an executor | role `toolsetScope` deny `kanban`/`delegation`/`terminal`/`code_execution` + MCP allowlist omits `prismer.task.*` |
+| **Install / manage skills** | You don't reshape the workspace | `toolsetScope` deny `skills`/`terminal` + MCP allowlist omits `prismer.skill.install` |
+| **Spend / collect money** | No fiscal authority | `terminal`/`code_execution` denied (no `cloud pay` CLI), `wechat-pay` skill not granted, and the payment service requires a mandate |
+| **Publish** (catalog / community / marketplace) | No outward-facing authority | MCP allowlist omits `prismer.evolve.publish` / `prismer.community.post`, and publishing already requires **owner approval** at the service layer |
+
+If a discussion outcome genuinely needs a task, a purchase, or a publication:
+**name that need in your reply and hand it to the workspace orchestrator**
+(the Team Manager / council facilitator). Do not attempt it — the attempt would fail at the
+capability gate anyway; naming it cleanly is the correct move.
+
+## Disclaimer (compliance floor)
+
+You are a **distilled public-record perspective, not the real person**. Keep that
+framing visible. Never assert private facts, never impersonate, never let the room
+treat your words as the person's private, authoritative statement.

package/built-in-skills/persona-generator/SKILL.md

@@ -0,0 +1,296 @@
+---
+name: persona-generator
+scope: common
+description: >
+  Given a Council Brief, produce persona-ROLE instance definitions: real,
+  publicly-verifiable people who occupy distinct stakeholder positions on the
+  issue — each a persona-flavored role template (lens / voice / SOUL + the
+  persona-skill capability boundary + icon + an ASCII usernameSlug), handed to
+  convene (council-creator) to be instantiated as a REAL agent. (Search
+  grounding of each person is done by the cloud /councils/plan handler, not by
+  this skill.) Use when the workspace orchestrator needs to convene an expert
+  roundtable ("帮我找几个人聊聊这个 idea"). Personas are LENSES distilled from
+  public records, not the real people — never assert private facts, never
+  impersonate. This skill produces the persona-role DEFINITIONS (who speaks); it
+  does NOT create the group and does NOT drive the discussion — that is
+  council-creator.
+license: MIT
+compatibility:
+  - prismer-sdk
+  - hermes
+metadata:
+  category: council
+  personaPolicy: public_distillation
+  disclaimerRequired: true
+  allowedUse: [analysis, debate, ideation]
+  forbiddenUse:
+    - impersonation
+    - private_claim
+    - legal_advice_without_disclaimer
+    - medical_advice_without_disclaimer
+    - financial_advice_without_disclaimer
+  eval:
+    level: generator # eval the GENERATOR against a Brief — never a single persona
+    assertions:
+      - positions-distinct # N personas occupy N distinct stakeholder positions (no two share one)
+      - insider-view-present # ≥1 persona sits where outsiders cannot see
+      - no-fabricated-people # every displayName is a real, publicly verifiable person
+      - risk-coverage-3plus # cast covers ≥3 risk dimensions (capital/tech/market/org/compliance)
+      - grounding-substring # every quote is a substring of a real search snippet (code-checked)
+      - brief-boundary # no persona asserts company facts beyond the Brief
+      - honest-degradation # ungroundable → role_label; fabricated quotes are a hard fail
+---
+
+# Persona Generator
+
+**Who speaks.** Given a Council Brief (assembled by the orchestrator from the
+Team Manager's materials + memory), produce `cast: PersonaDef[]` — 3–5 people occupying
+**distinct stakeholder positions**, each contributing the one thing only their
+position lets them see. This is a **capability skill**: the orchestrator calls
+it to produce data — a set of **persona-role instance definitions**. Each cast
+member is a persona-flavored **role template def** (lens / voice / SOUL + the
+persona-skill capability boundary + icon + an ASCII `usernameSlug`) that convene
+will instantiate as a **real agent** (`createAgentForWorkspace` + `applyToAgent`,
+M2). It is **not** a virtual `im_users` mask — persona = role instance.
+
+| Do | Do NOT |
+| --- | --- |
+| Enumerate stakeholder positions for the issue | Create the council group (council-creator) |
+| Pick one **real person** per position | Drive or moderate the discussion (council-creator) |
+| Produce `seesWhatOthersDont` per person | Write memory (settle phase, via `memory` skill) |
+| Emit voice (per-turn instructions) per person | Parse / extract materials (orchestrator tool-skills) |
+| Hand the cast to cloud `/councils/plan` for grounding | Run search verification / supply quotes yourself (cloud does it) |
+| Read `droppedCast[]` and substitute for dropped people | Invent people, quotes, or citations — ever |
+
+## Meta-goal (iron rule — supersedes any "debate" framing)
+
+**A discussion is a plurality of viewpoints, not a positive-vs-negative game.**
+Convene people of different identities, professions and stakes; each speaks
+from their own position. If disagreement emerges it is the *natural result* of
+plural perspectives — it is never something you construct. Do **not** hunt for
+"an opposing side"; a target function of "construct opposition" structurally
+excludes the two most valuable classes of people: **insiders** (dismissed as
+same-camp) and **people who reject the axis entirely** (nowhere to stand on
+it). The UI language is "讨论组" (discussion group), never "吵一架".
+
+## Core procedure
+
+### Step 0 — List stakeholder positions first (not "axes of disagreement")
+
+Before picking anyone, enumerate the positions whose duty / expertise / stake
+touches this issue:
+
+```
+运营执行者 / 出资人 / 监管者 / 同行实践者 / 下游客户 / 一线员工 / 被影响的第三方 …
+```
+
+### Step 1 — One REAL person per position
+
+- Pick the person whose **real public track record** naturally puts them in
+  that position. If no fitting famous person exists for a position (e.g. "this
+  company's own CTO"), pick a real person who once held the *equivalent*
+  position elsewhere (e.g. another rocket company's former CTO).
+- **Never invent a name.** Prefer swapping to a position where a real person
+  exists.
+- Do **not** require them to disagree with each other. They may all agree and
+  still each fill in a piece the Team Manager cannot see.
+- **Forbidden:** inserting an artificial "opposing side" to manufacture
+  conflict.
+
+For every person you MUST state `seesWhatOthersDont` — not "which side they
+are on", but "standing here, they can see X that nobody else at the table
+can". This field is the core output of the skill.
+
+### Step 2 — Attach the persona (who arrives at the table)
+
+- Enough verifiable public record and a good fit → **real name**
+  (`displayName: "Elon Musk"`, `subtitle: "SpaceX CEO"`). Compliance is
+  carried by the **disclaimer**, never by renaming — "Elon-style Strategy
+  Lens" style abstractions are forbidden (nobody wants to chat with a
+  concept). Internal terms (`persona`, `lens`) never surface in UI copy.
+- Otherwise → a role label ("一位持保守立场的航天投资人") — still a person,
+  not a concept.
+- `usernameSlug` (**load-bearing — this is the persona-agent's @-handle**):
+  ascii `[a-zA-Z0-9_-]`, 3–20 chars, lowercase slug of the person (e.g.
+  `elon-musk`). It must NOT start with the reserved `prismer-` segment. Final
+  uniqueness (`<slug>-<conv8>` + dedupe suffix) is enforced by the cloud at
+  convene time — you only produce the candidate slug. **Why it MUST be ASCII:**
+  once instantiated (M2), the persona-agent is addressed in the group **only**
+  by `@<usernameSlug>`. The mention router (`agent-dispatcher.ts` `MENTION_RE`)
+  is strict ASCII — a bare `@中文displayName` matches nothing and is silently
+  dropped, so a non-ASCII slug would leave the persona **unreachable** (0
+  dispatches, the exact 0/5 failure). The Chinese `displayName` is display-only;
+  it never routes.
+
+### Step 2.5 — Search grounding is done by the CLOUD, not by you
+
+You **only produce candidates** — position + real person + `seesWhatOthersDont`
++ candidate `usernameSlug`. **Do NOT run search verification yourself and do NOT
+supply any `realCredential` / `whySelected` quotes.** Grounding is performed by
+the cloud `/api/im/councils/plan` handler after you hand over the cast.
+
+- **Why cloud, not you (architectural, 04 §2.5):** the anti-fabrication defense
+  requires a **verbatim substring of a real search snippet**, checked in code
+  against full-text search (`/api/search`). The daemon `web_search` tool you can
+  reach routes through `/api/context/load`→`/api/compress`, so it returns
+  **LLM-rewritten prose, not the original text** — you physically cannot obtain
+  the verbatim snippet the substring check needs. Any quote you write from
+  memory would be a fabrication that the cloud check exists to reject.
+- **What the cloud does with your cast:** for each candidate it searches
+  `"<displayName> <topic terms>"` and requires the person's name + a topic term
+  to co-occur **inside the same sentence** ("some results exist" / "snippet
+  contains the keyword" passes off-topic celebrities — 04 §2.5 实测:
+  李开复+商业航天 returned 5 named-but-off-topic hits). Grounded → the persona is
+  kept with `groundingSource='searched'` and verbatim quote evidence. **0
+  co-occurrence → the person is dropped from the cast** and returned in the plan
+  response's `droppedCast[]` — read it and substitute someone else for that
+  position (do NOT patch up the quote).
+- **You still MUST NOT invent people.** Pick a real, publicly verifiable person
+  for each position (swap positions rather than inventing a name) — but leave the
+  evidence to the cloud. Your job ends at "who plausibly sits here"; the cloud
+  decides "is this person actually on-topic".
+- **`groundingTerms` (optional but recommended for mixed-language topics):** you
+  MAY attach a short `groundingTerms: string[]` per candidate — the topic keywords
+  in **the language this person's public record is in** (English for "Elon Musk",
+  中文 for a 中文人物). The cloud grounds against these instead of naively
+  tokenizing the question. Without them, a Chinese question ("2026年商业航天进展")
+  tokenizes to CJK bigrams that won't match an English-record person → that person
+  is wrongly dropped. So for an English-record person on a Chinese topic, supply
+  e.g. `["commercial spaceflight", "launch cost"]`.
+- 🚫 **Never use self-critique as fact-checking.** Asked to "verify the
+  citations are real", an LLM does not admit it cannot find them — it invents
+  a *more specific* fake source ("引自2021年新浪财经专访"). Self-critique is
+  allowed only for *structural* checks (two people on one position? invented
+  names? missing insider view?), never for factual ones.
+
+### Step 3 — Graceful degradation (three tiers, decided by the CLOUD)
+
+> ⚠️ This tiering is applied by the cloud grounding step, not by you — it is
+> shown here so you understand what happens to your candidates. You never set
+> `groundingSource` yourself. In the current implementation a candidate that is
+> not `searched` is returned in `droppedCast[]` for you to substitute.
+
+The criterion is "**can it be found by search?**" — programmatically checkable
+— never "does the model know enough?" (unverifiable; models claim they do).
+
+| Condition | Strategy | `groundingSource` |
+| --- | --- | --- |
+| Name + topic co-occur in one sentence of a snippet | Use its verbatim substring as the quote | `searched` |
+| Not searchable, but the user supplied materials | Ground the quote in the user's materials | `user_materials` |
+| Neither | **Degrade to a role label** ("一位持保守立场的航天投资人"), quote = null | `role_label` |
+
+`role_label` is the most honest tier and the lowest impersonation risk. The
+generator MUST be able to fall to it and MUST NOT fabricate quotes to "stay
+famous". (Legacy tiers `parametric` / `needs_materials` are retired — they
+presumed unverifiable parametric knowledge.)
+
+### Step 4 — Icon acquisition (cloud-executed; you only reference the result)
+
+Icon fetching and cropping run as **pure code on the cloud** (Serper image
+search → Content-Type + magic-bytes double gate → aspect-ratio cull only
+(0.6 ≤ ar ≤ 1.7, never re-rank by squareness — Google's own ranking encodes
+"this is the standard portrait") → **top-edge square crop**, no face-detect).
+Your responsibility is only to carry the resulting `iconAssetRef` (an
+`im_assets` id) into the PersonaDef, or `null` when nothing usable was found —
+the frontend degrades to a monogram. Never inline image bytes or hotlink URLs.
+
+### Step 5 — Voice
+
+`voice` = the persona-role's speaking instructions (markdown): the position,
+speaking style, and disclaimer discipline. Because persona is now a **role
+instance** (not a mask), `voice` — together with lens and a SOUL 特例档 — is what
+convene bakes into the persona-agent's role template at instantiation, so the
+agent speaks in-character from its **own** session (no one plays five roles).
+Write voice as durable, self-contained instructions the standalone agent can
+carry across turns, not one-off remarks. At convene time the cloud persists it
+onto the persona-agent so later `@<usernameSlug>` follow-ups reuse it.
+
+## Output shape (wire contract — aligns with `POST /api/im/councils/plan` cast)
+
+```jsonc
+{
+  "cast": [
+    {
+      "id": "elon-musk",                  // slug — also the personaId in council metadata
+      "displayName": "Elon Musk",         // REAL name; compliance rides the disclaimer
+      "subtitle": "SpaceX 创始人兼 CEO",   // who this person IS — from primary sources only
+      "usernameSlug": "elon-musk",        // ascii @-handle 3-20, no 'prismer-'; cloud dedupes — the ONLY way to reach this persona
+      "iconAssetRef": null,               // im_assets id from the cloud icon service, or null
+      "position": "同行实践者（已量产的商业航天创始人）",
+      "seesWhatOthersDont": "复用一子级的真实成本曲线与产线爬坡节奏",
+      // ⚠️ Do NOT supply realCredential / groundingSource — the cloud fills these
+      //    from live search after grounding (step 2.5). Omit them from your output.
+      "voice": "Speak as a first-principles propulsion founder. Terse. Numbers first. 你是公开资料蒸馏的视角，非本人；Brief 未提供的公司事实一律说「Brief 未提供」。",
+      "disclaimer": "公开资料蒸馏视角，非本人"
+    }
+  ]
+}
+```
+
+No `stance` field (the meta-goal is plural viewpoints, not sides). No `lens`
+field (a stance is the runtime product of `facts × issue`, not a stored
+attribute). Input: `{ brief, requestedPersonas?, n? }` (default n = 3–5).
+
+## Iron principle: persona = lens, Brief = facts (负控 N8)
+
+A persona **never carries company facts of its own**. Everything about the
+company comes from the Council Brief the orchestrator assembled. If a persona
+is asked to assert a company fact the Brief does not provide, it must say
+"Brief 未提供" or mark `needsVerification` — never improvise. This is the
+architectural cure for "stylized bubbles making things up", not a disclaimer.
+Bake this discipline into every `voice` you emit.
+
+At settle, `council-creator` turns this discipline into a **wire contract**: the
+report's `claims[]` each carry `sourceRefs[]` (the real material a fact stands
+on) + `needsVerification`, and unanswerable facts land in `gaps[]`. So your
+`voice` must instruct the persona to speak in **grounded, attributable claims**
+— tie each factual statement to the Brief fact it uses, and say "缺数据" (→
+`needsVerification=true`, `sourceRefs=[]`) rather than inventing a number, so
+council-creator can emit an honest structured report downstream.
+
+## Generator-level eval
+
+Eval judges the **generator** (input: a Brief; assertions over the cast as a
+set), never a single persona. Code-enforceable oracles are the two grounding
+checks (substring + same-sentence co-occurrence); the set-level assertions
+below are eval judgements (semantic classification):
+
+| Assertion | Criterion |
+| --- | --- |
+| Positions distinct | N personas occupy N different stakeholder positions; no two share one |
+| Insider view present | ≥1 person sits where outsiders cannot see (operator / front-line / former insider) |
+| No fabricated people | every `displayName` is real and publicly verifiable (`realCredential` non-empty) |
+| Risk coverage | cast covers ≥3 of: capital / tech / market / org / compliance |
+| Grounding real | every quote is a snippet substring + same-sentence co-occurrence (code check) |
+| Brief boundary | no persona asserts company facts beyond the Brief |
+| Honest degradation | unsearchable → `role_label`, never a fabricated quote |
+
+## Promote escape hatch
+
+An exceptionally good cast can be saved as a **`persona-pack` skill** (static
+snapshot, `metadata.category: council`, `personaPolicy: public_distillation`,
+`disclaimerRequired: true`) and published to the marketplace for fork / rate /
+compose. This is a third, non-default path — the default is always fresh
+generation against the current Brief.
+
+## Configuration
+
+**N/A.** This skill declares no `config:` block. Grounding credentials
+(search API keys) live cloud-side as Nacos global config consumed by the
+`/api/im/councils/plan` handler and `/api/search` — they are never
+agent-bound, so there is nothing for the skill-config binding system to carry
+(product204/09 boundary ruling, CONFLICT-7).
+
+## Anti-patterns
+
+- ❌ Inventing a person because a position "needs" someone famous (the
+  documented failure: `Will Smith` as Relativity's CEO — the real CEO is Tim
+  Ellis). Swap positions instead.
+- ❌ Filling the cast with five competitor CEOs (letting competitors judge
+  your valuation) — that is the retired adversarial framing.
+- ❌ Writing quotes from memory, or "verifying" them by self-critique.
+- ❌ Renaming a real person into a concept ("工程激进视角") to dodge
+  compliance — the disclaimer carries compliance.
+- ❌ Emitting `stance` / picking a side for anyone.
+- ❌ Creating the group, posting messages, or driving rounds — hand the cast
+  to council-creator.